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Abstract — We consider the problem of secure communications 
over the two-way wiretap channel under a strong secrecy criterion. 
We improve existing results by developing an achievable region 
based on strategies that exploit both the interference at the eaves- 
dropper's terminal and cooperation between legitimate users. We 
leverage the notion of channel resolvability for the multiple-access 
channel to analyze cooperative jamming and we show that the 
artificial noise created by cooperative jamming induces a source 
of common randomness that can be used for secret-key agreement. 
We illustrate the gain provided by this coding technique in the case 
of the Gaussian two-way wiretap channel, and we show significant 
improvements for some channel configurations. 

Index Terms — Key generation, resolvability, secure communica- 
tions, strong secrecy, two-way wiretap channel. 
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I. Introduction 

IN CRYPTOGRAPHY, noise is often viewed as an impairment 
that should be handled at the physical layer before any 
encryption is applied. In contrast, the works of Wyner JTJ and 
Csiszar and Komer [2| on the wiretap channel, and Maurer p) 
and Ahlswede and Csiszar [4| on secret-key agreement from 
common randomness support the idea that there is much security 
to be gained by exploiting the noise present at the physical layer. 
This concept, colloquially known as physical-layer security, has 
attracted a growing interest and has led to numerous extensions 
of the wiretap channel model |5), (6|. 

In particular, the analysis of multi-user channel models with 
secrecy constraints has highlighted the pivotal role of coop- 
eration, jamming, and feedback as means to increase secure 
communication rates. The two-way wiretap channel, in which 
users communicate over a noisy bidirectional channel while 
an eavesdropper observes interfering signals, combines all the 
aforementioned effects because users have the possibility of 
cooperating while simultaneously jamming the eavesdropper. 
This model was first investigated by Tekin and Yener (7), (8) 
who showed that jamming with noise or controlled interference 
between codewords could provide secrecy gains. However, this 
strategy called cooperative jamming does not exploit feedback. 
It was later shown by He and Yener [9] and Bloch flO) that 
strategies based on feedback can perform strictly better than co- 
operative jamming alone. Recently, El Gamal et al. [11] proposed 
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an achievable region for the two-way wiretap channel combining 
cooperative jamming and a secret-key exchange mechanism to 
transfer secure rate between users. 

From a practical perspective, the two-way wiretap channel 
captures some of the limitations of real systems because all 
communications are intrinsically rate-limited. We note that the 
two-way wiretap channel also generalizes many models; for 
instance, the works of Amariucai and Wei fl2) , Giindiiz et 
al. fl3) , and Lai et al. |14| are special cases that focus on 
secure communication for one user only. Similarly, the model of 
Ardestanizadeh et al. fl3) is a two-way wiretap channel in which 
one of the link is confidential and unheard by the eavesdropper. 
Many works on secret-key agreement with rate-limited public 
communication can be analyzed within this framework fl6) , 1 17 1 
as well. 

In this paper, we extend existing results in several directions. 

We show that it is possible to design powerful coding schemes 
by partially decoupling the feedback and the interference and by 
relying on the following strategies: 

• Cooperative jamming, which leverages codeword interfer- 
ence to give legitimate users an advantage over the eaves- 
dropper by reducing its signal-to-noise ratio. 

• Key exchange, by which one user sacrifices part of its secret 
rate to transmit a key to the other, which uses the key to 
encrypt a message, thus augmenting its own secret rate. 
Note that key exchange is a basic feedback mechanism that 
transfers secure rate from one user to the other, but does not 
generate new secrecy. 

• Key generation, by which the users exploit the intrinsic 
randomness of the channel to generate a secret key. Since 
channels are noisy, the communication required to distill the 
key is inherently rate-limited. The key is then used by one 
of the users to encrypt a message, and to increase its secret 
communication rate. 

We establish strong secrecy results, which require the eavesdrop- 
per to obtain a negligible amount of information instead of a neg- 
ligible rate of information, by exploiting the concept of channel 
resolvability 1 18 |-J22) to analyze cooperative jamming. Channel 



resolvability provides a conceptually convenient interpretation of 
cooperative jamming, which allows us to analyze what happens 
when transmitting beyond the capacity of the eavesdropper's 
channel. 

The outline of this paper is as follows. In Section[llJ we provide 
definitions of a two-way wiretap channel and a wiretap code. In 



Section III we derive a region of strongly secure rates achievable 



with cooperative jamming based on channel resolvability. This 
first step yields a result similar to what Tekin and Yener |7j 
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Theorem 2] obtained for weak secrecy. In Section IV the 
region is improved by introducing the key exchange mechanism 
proposed in [9 1, [11]. We further extend this region by performing 
secret key generation from a source induced by the noise used 
in cooperative jamming. Finally, in Section [V] we illustrate the 
achievable region in the Gaussian case. Section VI concludes the 



ALICE 



BOB 



paper by discussing possible extensions of this work. 

II. Problem Statement 

Notation: Consider two random variables X and Y taking 
values in alphabets X and y. Sample values of X and Y are 
denoted by x and y, respectively; the joint probability law is 
denoted by pxy, and the marginal probabilities are denoted by 
Px and py, respectively. We suppose all probability laws either 
discrete or Gaussian. The mutual information between X and Y 
is the random variable: 



I{X-Y)^i x ., Y {X-Y) where: i x , Y 4 log 2 



Pxy 



PxPy 

We refer to the average of the mutual information random variable 
as the average mutual information, and denote it by 

1(X;Y)±E(I(X;Y)), 

the entropy corresponds to M(X) = I(X; X). The weakly typical 
set with respect to distribution px and e is denoted A™(X). 
Finally, we let 6(e) (resp. 8(n)) be a short-hand notation for any 
function of e (resp. n) that goes to zero as e goes to zero (resp. 
n goes to infinity). We also introduce the integer interval [a, 6] 
consisting of all integers between [a\ and \b~\. 

We consider the problem of secure communication over a two- 
way wiretap channel illustrated in Fig. [T] in which: 

• a legitimate user called Alice (or transmitter 1) sends mes- 
sage M\ and estimates M 2 ; 

• another legitimate user called Bob (or transmitter 2) sends 
message M 2 and estimates Mi; 

• an eavesdropper called Eve observes Z n . 

We assume the channel is full-duplex, which means Alice and 
Bob communicate simultaneously over the channel. This assump- 
tion is relevant for some communication systems; however, it may 
be hard to realize in practice and many experimental communica- 
tion systems operate with half-duplex, potentially yielding lower 
rates. The analysis of half-duplex channels is left as future work. 
Definition 1: A two-way wiretap channel denoted by 
Y?z n \x?x$} n>1 ) consists of two 
arbitrary input alphabets X± and X 2 , three arbitrary output 
alphabets y±, y 2 and Z, and a sequence of transition 
probabilities {p Y ?Y«z™\x?x$ } n>1 such that: 

Vn G N*,V(x?,a?5) G X[ l x X 2 , 

E E E PY?Y^\x?x 5 (y?,y2,z n \x?,x2) = i. 

y?ey? y' 2 l eys z n ez n 

(1) 

We consider hereafter a memoryless wiretap channel, but we 
note that our approach and our results generalize in part to 
arbitrary channels using information spectrum methods p0) . 
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Fig. 1. Communication over a two-way wiretap channel 



Definition 2: A memoryless two-way wiretap channel (WTC2 
for short) denoted by (X l7 X 2 ,y 1 ,y 2 , Z,p YlY2 z lXl x 2 ) is a two- 
way wiretap channel for which: 

V , zj, tf, yj, z n ) G X? x X? x y? x x Z'\ 
PY?Y?z-\x-x-(y 1 ,y 2 ,z n \x n l ,x n 2 ) = 

n 

PY 1 Y 2 Z\X 1 X 2 ( Vl >2/2 i Z Pi > x 2 )■ ( 2 > 

i=l 

Now, we formally define a code for the two-way wiretap 
channel. 

Definition 3: A (2 nRl , 2 nFt2 , n) two-way wiretap channel 
code C n consists of: 

1) Two message alphabets: Mi = [l,2 nfll ] and M 2 = 
[1,2^]. 

2) Two local sources of randomness (IZi , pn x ) and (1Z 2 , pn 2 ) 
independent of the channel and messages. 

3) Two sets of encoding functions that map a message and 
past channel observations to a channel input symbol: 

• n encoding functions for transmitter 1: 

G [l,n], if : Mi x y^ 1 xTZi^X i; 

• n encoding functions for transmitter 2: 

V* G II, nj, : M 2 x y^ 1 x TZ 2 -> X 2 . 

4) Two decoding functions that map channel observations to 
a message or an error symbol "?': 

• 91 : y? xMix1l 1 ^M 2 U {?}; 

• 92 ■ y 2 x M 2 x K 2 -> Mi U {?}. 

We also define the following quantities to assess the perfor- 
mance of a code C n : 

• the probability of error: 

P e (C„) 4 p((Mi,M 2 ) + (Mi,M 2 )\C n y, 

• the information leakage to the eavesdropper: 

L(C n )±I(Z n ;MiM 2 \C n ). 

Definition 4: A rate pair (Ri,R 2 ) is achievable for a WTC2 
if there exists a sequence of codes {C n } n ^i such that: 
lim P e (C„) = (Reliability); 

n— yoo 

lim L(C n ) — (Strong secrecy). 
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Definition 5: The strong secrecy capacity region 7Z 2Vf is de- 
fined as: 



2W A 



cl ({(.Ri, i? 2 ) : {R\,R%) is achievable}). 



We denote by 7?. 2W the weak secrecy capacity region. 

We are interested in characterizing the entire region of achiev- 
able rate pairs (Ri,R 2 ), but it is rather difficult to obtain 
a closed-form expression. In principle, the coding scheme in 
Definition [3] could simultaneously exploit the interference of 
transmitted signals at the eavesdropper's terminal and feedback. 
To obtain some insight, we study instead a simpler strategy that 
partially decouples these two effects as follows: 

• First, we exploit interference to penalize the eavesdropper 
and increase secure communication rates. The interference 
can be of two types: interference between codewords or 
jamming with noise. 

• Next, we introduce feedback by means of key exchange 
and key generation. With key exchange, one user sacrifices 
part of its secure communication rate to exchange a secret 
key, whereas with key generation both users exploit channel 
randomness to distill keys. Those keys are then used to 
encrypt messages with a one-time pad. 

III. Resolvability-Based Cooperative Jamming 
A. Cooperative Jamming 

A natural attempt to increase secure communication rates con- 
sists in jamming Eve with noise, in order to decrease her signal- 
to-noise ratio. This strategy, called cooperative jamming |23] , 
forces one user to stop transmitting information to jam the 
eavesdropper. To overcome this limitation, Alice and Bob can 
use codewords whose interference also has a detrimental effect 
on Eve without sacrificing as much information rate. This scheme 
is called coded cooperative jamming and was introduced by Tekin 
and Yener jTJ, (8). It is possible to combine both strategies and 
have Alice and Bob perform coded cooperative jamming while 
simultaneously jamming the eavesdropper with noise. Simulta- 
neous cooperative jamming can be implemented by prefixing an 
artificial discrete memoryless channel (DMC) before the WTC2 
and sending codewords through the concatenated channels. This 
technique is therefore called prefixing in flT) . 

Note that cooperative jamming does not exploit feedback, 
which corresponds to using only two encoding functions f± 
and f 2 ^ in Definition [3] Using cooperative jamming is then 
equivalent to studying the simplified channel model illustrated 
in Fig. [2] in which the eavesdropper observes the output of a 
multiple-access channel. 



B. Achievable Region 

We first derive an achievable region using the notion of channel 
resolvability and auxiliary messages M[ £ M\ = [l,2"" Rl ], 
uniformly distributed, and M 2 £ M 2 — \l,2 nR *\, uniformly 
distributed, in place of (HiiPRx) and (1Z2,Pr 2 ). This region is 
given in Proposition [T] 




Py»y,:z«\x['x$ 
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Fig. 2. Communication over a two-way wiretap channel without feedback 



Proposition 1: 



TZ = Proj |J 

Rl;R2 p(£V 



where Proj Riji j 2 
(Ri,R 2 ), and: 



(Ri\ 
R2 
R'i 



R 1 +R[^l(Y 2 ;C 1 \X 2 ) 
R 2 + R 2 ^l(Y 1 ;C 2 \X 1 ) 
R[ + R' 2 ^ I(C\C 2 :Z) 

R! 2 >\{C 2 -Z) 



2\V 



(3) 



is the projection on the plane of rates 



"P = {px 1 x 2 c 1 c 2 y 1 y 2 z 

factorizing as: p Yl Y 2 z\x 1 x 2 Px x \C x Pa Px 2 \c 2 Pc 2 }- (4) 

Remark A similar result has been independently established 
by Yassaee and Aref ]24) using a related technique based on 
approximation of output statistics. However, their proof only 
holds for discrete memoryless channel because it is based on 
strongly typical sequences. In our proof, we use Steinberg's 
results [19 1, which also hold for Gaussian memoryless channels. 



Proof of Proposition [7J 

In this proof, we consider two types of transmitted messages. 
First, the main messages, which must be transmitted between 
Alice and Bob reliably and securely with respect to Eve. Sec- 
ond, the auxiliary messages, which are used to perform coded 
cooperative jamming and introduce randomness to mislead the 
eavesdropper. Although auxiliary messages do not carry informa- 
tion by themselves, we require that Alice and Bob decode them 
reliably. We also perform simultaneous cooperative jamming by 
prefixing DMCs. 

The proof is based on random coding. We fix distributions pc\, 

Pc 2 , Px 1 \c 1 and p X2 \c 2 - Let e > 0. 

Code creation: We create the code as follows: 

• Code generation: we generate the codewords at random: 
Generate |~2™ fll ] |~2 ni?1 ] i.i.d. sequences c"(/ii) with \i\ = 

G Mi x M[ according to p Cl , and |~2 ni?2 ] \2 nR *) 
i.i.d. sequences c 2 ([i 2 ) with [i 2 = (i,j) G M 2 x M' 2 
according to pc 2 - Here, i represents the index of the main 
message, j the index of the auxiliary message. We denote 
by C„ the random variable representing the generated code 
and by C n one of its realizations. 

• Encoding: If Alice wants to send fii e M± x M[, she 
computes c™ (hi), and transmits obtained by sending c™ 
through a DMC with transition probability PxJcv 
Similarly, if Bob wants to send \i 2 £ M 2 xM' 2 , he computes 
c 2 0^2)1 and transmits x 2 obtained by sending c 2 through a 
DMC with transition probability px 2 \c 2 - 
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The DMCs with transition probabilities PxilOi an d Px 2 \C 2 
are prefix channels used for simultaneous cooperative jam- 
ming to confuse the eavesdropper. 
• Decoding: we consider a typical set decoder. 

Let us define A? £ = A^(X 1 ,C 2 ,Y 1 ) and A 2 l £ = 
A*(X 2 ,C U Y 2 ). 

If yi is received by Alice, she selects fa such that 
(x™, c 2 (fa) j Vi) € if £ . If such a tuple exists and is 
unique, output fa, otherwise declare an error (fa =?). 
If y 2 is received by Bob, he selects fa such that 
(a;^) c" (fa) , y 2 ) € ijf ^ sucn a tuple exists and is 
unique, output fa, otherwise declare an error (fa =?). 

Probability of error analysis: We study the probability of 
error defined as: 



,{C n )^v({M 1 ,M 2 ,M[,M' 2 ) £ (Mi, M a , Mj, M^ 



Cn). (5) 



We are looking for conditions on rates such that this probability 
of error goes to zero as n goes to infinity. We use the following 
Lemma. 

Lemma 1: (Probability of error) For e > 0, 



R 1 +R[ <l(Y 2 ;C 1 \X 2 ) 
R 2 + R! 2 <I(Y l] C 2 \X l ) 

Proof: see Appendix |A| 



lim E(P e (C n )) < 6(e). (6) 



Remark Lemma [T] gives conditions for reliable communication 
regardless of the eavesdropper, which is intuitive because reliabil- 
ity only depends on what is happening between the two legitimate 
users. However, this differs from the proof in |7|, in which 
additional reliability constraints that depend on the eavesdropper 
are introduced to compute the leakage. 

Leakage analysis: We study the leakage defined as: 



Code selection: By Markov's inequality, we have 

1 



lim P(P e (C n ) > 3<5(e)) < 
lim P(L(C„) > 3.5(e)) < 



therefore, we conclude that there exists a specific sequence of 
codes {C n }„>i such that lim P e (C„) ^ 5(e), and lim L(C n ) ^ 
6(e). 

Remark Each code C n consists of a pair of codes (C\,C 2 ). 
Although the codes C\ and C 2 are generated according to in- 
dependent distributions, note that both codes are jointly selected; 
therefore, the codes are used independently by Alice and Bob but 
optimized jointly to guarantee secrecy. 

Conclusion: For any e > 0, there exists a code such 
that the probability of error and the leakage are smaller than 
6(e). Therefore, it is possible to create a sequence of codes 
{C„(e„)}„^i with e n — > 0. 

n— >oo 

By combining the rate constraints in |6]) and ([8]), we get the 
result given in Proposition [T] ■ 

By elimination of the auxiliary rates R[ and R' 2 , we obtain the 
following region: 

Corollary 1 (Strongly secure achievable region): 



K = 

u 

where: 



Ri 
R 2 



Ri 



/2i<I(y 2 ;Ci|X 2 ) 
R 2 ^l(Y 1 ;C 2 \X 1 ) 
R 2 ^I(Y 2 ;C 1 \X 2 ) 



l(C x ;Z) 
1{C 2 ;Z) 
-I(r 1 ;C7 2 |X 1 ) 
l(C 2 C 2l Z) 



2\\ 



(9) 



L(C„)^I(Z";MiM 2 |C n ). 
Lemma 2: (Leakage) For e > 0, 



(7) 



R[ + R' 2 > I(dC 2 ; Z) 
R[ > l(Ci,Z) 
R' 2 >l(C 2 -Z) 

Proof: see Appendix [B] 



lim E(L(C„)) ^ 5(e). (8) 



Remark To interpret this result, we need to precisely understand 
the role of auxiliary messages M[ and M 2 . These messages are 
introduced to replace the sources of randomness and Lemma [2] 
gives lower bounds on the rates of these auxiliary messages. This 
result is intuitive: to prevent Eve from recovering the messages, 
more randomness must be introduced in the encoding process. 
Lemma [2] shows that there exist minimum values of the rates 
such that they allow zero asymptotical leakage. 

It is important to remember that, because of the constraints 
imposed by Lemma [T] increasing auxiliary message rates reduces 
the amount of information one can transmit through the channel. 



V = {px 1 x 2 c 1 c 2 y 1 y 2 z factorizing as: 

Py 1 y 2 z\x 1 x 2 Px 1 \c 1 Pc 1 Px 2 \c 2 Pc 2 }- (10) 

Proof of Corollary [7} With ^ and ((HJ, we have: 

R l + R[ +R 2 +R' 2 ^ l(Y 2 ; d\X 2 ) + l(Y 1 ;C 2 \X 1 ) 
R, + R 2 ^ I(Y 2 ; d\X 2 ) + I(Y 1 ;C 2 \X 1 ) - R[ - R' 2 
R!+R 2 ^ I(Y 2 ; d\X 2 ) + I(Y 1 ;C 2 \X 1 ) - I(C 2 C 2 ; Z). 

Using |3]l and (|8), we also have: 

R 1 +ie i ^l{Y 2 ;C 1 \X 2 ) 

Ri s? l(Y 2 ;Cx\X 2 )-R[ 
R 1 ^1(Y 2 ;C 1 \X 2 )-I(C 1 ;Z). 

Similarly, we have: R 2 ^ l(Yi; C 2 |Xi) - I(C 2 ; Z). ■ 
The region described in |9]) is identical to the one obtained by 
Tekin and Yener in |7J, (8) for weak secrecy. However, a closer 
look at the proof shows that their result is obtained by projecting 
the region 1Z' defined as: 
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fRi\ 
R'i 



i? 1 +i?i^I(F 2 ;C7 1 |X 2 ) 
R 2 + R' 2 ^I(Y 1 ;C 2 \X 1 ) 
R' 1 +R! 2 = I{C 1 C 2 ;Z) }. (11) 

This region differs from the one in Proposition[T]in the constraints 
on auxiliary message rates (R^R^), The difference is shown in 
Fig. [3] where the dark area corresponds to constraints (|8]l and 
the light one to the constraints on (R[, R' 2 ) in (JTTJ. Note that the 
latter corresponds to the achievable region of a multiple access 
channel (MAC). This is not surprising because the proof of ( fTT| 
relies explicitly on the analysis of the probability of error for the 
eavesdropper, who obtains its signal through a virtual multiple 
access channel as shown in Fig. [2] In contrast, our approach 
analyzes the secrecy constraint directly, which leads to lower 
bounds on the auxiliary message rate required to confuse the 
eavesdropper. The projection of both regions on the plane of 
rates (Ri,R 2 ) is the same because it corresponds to having the 
auxiliary message rates on the diagonal edge, which is common 
to both. In terms of code structure, the approach of Tekin and 
Yener consists in augmenting the number of auxiliary messages 
until the leakage to the eavesdropper become negligible, which 
only happens on the slope of the MAC region. Our constraints 
directly give a region with negligible leakage and the approach 
consists in finding the minimum number of auxiliary messages 
needed to confuse the eavesdropper, and, therefore, augmenting 
the number of secret messages to the maximum possible value. 




I(C i; Z) I(Ci;Z|C 3 ) l(Ci,C 2 ;Z) R[ 
Fig. 3. Constraints on Kj and R' 2 in |8j and 



IV. Key Exchange and Key Generation 

In the previous section, we have exploited the benefits of coded 
cooperative jamming and simultaneous cooperative jamming, but 
we did not exploit the possibility of feedback. We introduce 
feedback with two mechanisms: 

• we use the technique of (9j and pT[ to transfer secret rate 
from one user to the other; 

• we use the randomness introduced by cooperative jamming 
to induce a source from which we generate secret keys. 



Note that we can only exchange information through a rate- 
limited channel; therefore, we rely on results for secret 
key agreement with rate-limited public communication fl6) , 

A. Key Exchange 

We introduce key exchange on top of the cooperative jamming 
scheme introduced in Section [ill] by splitting the main and auxil- 
iary messages into multiple parts. We use these sub-messages as 
a means to exchange a key using the secret channel and encrypt 
part of the public message. Because of the "secret rate transfer" 
we need to redefine which rates we are considering. 

Let us consider a code for cooperative jamming with secret 
message rates (Ri,R 2 ) and auxiliary messages rates (R'i,R' 2 ). 
For i € {1, 2}, we split the main message M, into two parts: 

• A key, which is used for encryption by the other user: Ki £ 
Ki= [l, 2 nR iJ ; user i needs to sacrifice a part of its secret 
message to transmit this key. 

• A secret message: Si € Si = [l,2 Tlfii ]; this part corre- 
sponds to the part of secret message user i does not sacrifice. 

We also split the auxiliary message M[ in two parts: 

• A message En, which is encrypted with the key sent by the 
other user to give E Si — [l, 2 nR *J . Encryption is done 
with a one-time pad to ensure perfect secrecy f25) . 

• An open message : Oi EOi= [l, 2 nR °j ; this corresponds to 
the part of the message that remains public and still perfectly 
decodable by the receiver. 

By convention, if no key is available R\ = 0, else, by 
construction, R\ < R\, R 2 < R\. We denote: Mi = Si x /C 2 , 
M.' i = Oi x Si. Therefore, we have the following relationships 
between the various rates: 



R\ = R\ + R\, R 2 — R 2 + i?2, 

r>> no i r>e r>> no i pe 

Hi — lti + Hi , tx 2 — t\ 2 + lt 2 . 



(12) 



Although R 2 , R[, R' 2 ) still represents the rates provided 
by cooperative jamming, they are no longer the rates of interest 
after key exchange. In fact, part of the auxiliary message is 
encrypted while part of the secret message is sacrificed to 
exchange a key. Hence, the rates we need to consider are the 
following: 

• a pair of secret rates: Ri = R\ + R\, and R 2 = R 2 + R 2 ; 

• a pair of public rates: R'i — R°, and R' 2 — R 2 - 

Remark Because the key sent by one user cannot be used 
simultaneously by the other, the key exchange scheme must 
operate in several rounds. At each round, we use the key sent 
in the previous one, except in the first round where no key is 
available. If we use a code of length n B times, we obtain a 
new code of length n' = Bn; the first message does not use key 
exchange, but the next B — 1 do. If the communication rate for 
the first message is R* , for the B — 1 others it is R, and the 
overall rate is R, we have: 



R 



nR* +n(B - 1)R 

nB B->oo 



R. 



Thus, the first round incurs a negligible rate penalty for B going 
to infinity. 
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For weak secrecy, [11] proves the following proposition: 
Proposition 2 (El Gamal et al.): 



TU = 



U 



where: 



R2 



Ri 



Ri^l(Y 2 ;Ci\X 2 ) 
R 2 ^l(Y 1 ;C 2 \X 1 ) 
R 2 ^l(Y 2 ;C 1 \X 2 ) 



■I(yi;C 2 |Xi) 
I(C 2 C 2 ;Z) 



C K 



2W 



(13) 



V = {px 1 x 2 c 1 c 2 y 1 y 2 z factorizing as: 

PY 1 Y 2 ZX 1 X 2 PXi\d PCt PX 2 \C 2 PC 2 }- (14) 



Based on Section III we also have this result for strong secrecy: 

n F c n 2W . 

Remark By comparing |9} and (jT3j, we see that key exchange 
improves the individual bounds on R\ and R 2 , but not the 
bound on the sum-rate. Individual bounds on R\ and R 2 actually 
correspond to the capacity of the channel between the two users 
and cannot be improved; therefore, any improvement on the 
region should modify the sum-rate constraint. 



B. Key Generation from Induced Source 

Key exchange requires sacrificing part of the secret rate of one 
user. In addition, we can use the channel randomness introduced 
for simultaneous cooperative jamming to extract secret keys. 
Although users must exchange additional messages to agree on 
a common secret key, key generation only comes at the expense 
of public message rate. 

In the next section, we study the Gaussian two-way wiretap 
channel and we explicitly show how cooperative jamming induces 
a discrete memoryless source (DMS) (X,Y,Z) independent of 
all other observations, which can be used to distill a secret key. 
The existence of this DMS is not obvious because the noise 
introduced by cooperative jamming is already exploited to harm 
the eavesdropper and it is a priori unclear if it could be used 
simultaneously as a source of common randomness for secret- 
key agreement. We start by clarifying what knowledge of the 
eavesdropper needs to be considered to identify the DMS. Let K 
be the secret key to generate and let M\, M 2 , M[ and M' 2 be the 
secret and auxiliary messages used in the cooperative jamming 
code. The key and secret messages must be independent and 
both must be hidden from the eavesdropper, that is for e > 0, 
l(MiM 2 K; Z n ) e. Notice that 



l(M 1 M 2 K;Z n ) 



l{M 1 M 2 ;Z n ) 
\(M X M 2 -Z n ) 



\(K;Z n \M x M 2 ) 
\{K;Z n M x M 2 ). 



The term \(M\M 2 \ Z n ) can be smaller than e/2 by construction 
of the cooperative jamming code but note that we must then have 
I(K\ Z n MiM 2 ) e/2; this means that the key must be hidden 
from an eavesdropper having access not only to the observation 



Z n but also to the secret messages M\ and M 2 . Furthermore, 
note that 

I(MiM 2 K;Z n ) 

= 1{M X M 2 ; Z n ) + I(K; Z n MxM 2 M[M' 2 ) 

-I(K;M[M' 2 \Z n MxM 2 ). 

If the cooperative jamming code is chosen to provide the highest 
secrecy rate, the public message rates must be chosen to lie on 
the boundary of the region in Q, for which (7), (8) shows that 
W(M' l M 2 ^\Z n MiM 2 ) < e/2. In this case, we obtain: 

l(M x M 2 K; Z n ) > I(M t Af 2 ; Z n ) 

+ l(K; Z n Mi M 2 M[ M 2 ) - | 

In other words, we can assume that the key K must be kept secret 
from an eavesdropper observing not only the channel output Z n 
but also knowing the secret and auxiliary messages transmitted 
by the legitimate users. 

C. Achievable region with key exchange and key generation 

In this section, we provide a generic strategy and an achiev- 
able region based on cooperative jamming, key exchange and 
key generation. We assume the existence of a DMS (X,Y,Z) 
independent of all other observations induced by cooperative 
jamming. The statistics of the DMS depend both on channel 
statistics and the code used for communications, but we do not 
attempt to characterize them exactly. 



R{ 
Ri 

Rl + R\ +R° 2 + R e 2 ^ I(CiC 2 ; Z) 



Ri 



R° 
R° 



First, note that substituting the rates defined in ( 12 1 in Proposi- 
tion[T]gives a set of constraints that achievable rates must satisfy: 

R\ + Rl + Rl ^I(Y 2 ;C\\X 2 ) (15) 
RI sSI(Yi;C 2 \Xi) (16) 

(17) 

RI +RI > I(d;Z) (18) 
R° 2 + Rl^I(C 2 ;Z). (19) 

In order to add a key generation step, we need to further split 
message rates in multiple parts. For instance, Alice modifies her 
rates as follows: 

• R\ = R\. Secret key generation does not change anything 
for the secret message rate. 

• R\ = R\. Secret key generation does not change anything 
for the secret key rate used for key exchange. 

• R° = R° — R\ — R\. A part R\ of the open message rate 
is used for secret-key generation while a part R\ is used to 
transmit an encrypted message with that same key. Notice 
that the constraint R° ^ _fq + R\ must be satisfied. 

• R\ = R\ + R\. Thanks to key generation the encrypted 
message rate increases. 

Alice's total secure communication rate is then R\ + R\. Bob 
modifies his rates in a similar way. 

Even if the DMS was characterized exactly, the secret-key 
capacity of a source with rate-limited public communication is 
not known. Therefore, we focus on a suboptimal key agreement 
strategy in which a single user sacrifices a fraction -R p of its 
open message rate for communication and a single user uses the 
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secret-key generated from the source for encryption. In this case, 
the optimal key generation rate R k that can be distilled with rate- 



limited public communication is known |16 Theorem 2.6]: 

R k < l(V; X\U\ - l(V; Z\U^ , 

where the random variables U and V are such that U f-> V 4-> 
Y o XZ forms a Markov chain and 



V;Y) -l[V;Xj < i? p . 

Depending on which user performs public discussion and which 
user encrypts a message we obtain additional constraints on RP 
and R k . Specifically, we have four possible configurations given 
in Table D 



~ ~ ___^ public com. 

encryption — — — ______ 


Alice 


Bob 


Alice: R~ = R\ , R\ = 


R{ + R\^ R° 


1 


R\ ^ Rl 


Bob: R\ = R\, R\ = 


\ 


rP 2 < i?5 





TABLE I 

Additional constraints for key generation 



Although we do not attempt to obtain a closed-form expression, 
note that key generation can loosen the sum-rate constraint 
in ([13). 

V. Gaussian Two-Way Wiretap Channel 

In this section, we evaluate an achievable region based on the 
strategies developed in previous sections. We consider a Gaussian 
two-way wiretap channel for which the relationships between 
inputs and outputs are: 



Y 2 n = X? + ^X% + N? 2 

Z n = y/JnX? + y/lHX% + N?. 



(20) 



In addition the inputs are subject to the power constraints 
1 \ - 

n 



=1 



E 



1 

1 and - > E 

n 

i=l 



X, 



(i) 



S$ Pi- 



We suppose the additive noises N 2l , N™ 2 , and TV™ are i.i.d. zero- 
mean unit-variance Gaussian vectors. We implement cooperative 
jamming by prefixing an additive white Gaussian noise (AWGN) 
channel before each input of WTC2. This is equivalent to 
considering a modified channel with inputs C\ and C 2 , with: 

X? = CI + N[\ and X™ = C™ + _V™ 2 , (21) 

where iV™ - yV(0, p'{S. n ) and N% 2 - 7V(0,p_I n ) correspond to 
the noise introduced by users to realize cooperative jamming. We 
suppose pi ^ pi and p 2 ^ p 2 , and obtain the modified power 
constraints: 



to account 



With minor modifications of the proof of Section III 
for the power constraints, we obtain an achievable region for the 
Gaussian two-way wiretap channel by substituting the random 
variables G\ ~ Af(0,pl) and C 2 — J\f(0,p 2 ) in the bounds 
obtained earlier. 



A. Randomness Source Extraction 

We provide an explicit characterization of the DMS induced 
by cooperative jamming, which we will use to extract a key later 
on. Define: 



Xi = Nn 
X 2 = N 22 



Y!=X 2 
Y 2 =X X 



N 2 i 
N 12 



fh 2 X 2 + N e . 

Proposition 3: The ttiple (X,Y,Z) with X = (Xi,Yi) and 
Y = {X 2 , Y 2 ) is an independent DMS that can be used for key 
generation. Alice, Bob and Eve observe the components X, Y, 
and Z, respectively. 

Proof: Since Alice generates the noise _Vn, she obtains Xi 
directly. She also observes the channel output Y™ = C 2 + N 22 + 
N21 + \/9iXi"< since she knows X™ and can decode C 2 with 
high probability, she can obtain Y\. Similarly, Bob can obtain X 2 
and Y 2 . 



Eve observes the channel output Z n = \fh\ X[ l + \[h 2 X 2 



and, as discussed in Section IV we assume she obtains C™ and 
C 2 as side-information. Therefore, Eve can compute Z, but we 
also need to show that Z n is a sufficient statistic for X n and Y n 
given (Z n , C™, C 2 ). This is the case because: 

U(X n ,Y n \Z n C?C%) = M{X n ,Y n \Z n C^C'S) 
= H(X n ,Y n \Z n ) 

because (a): ZdC 2 ^ ZdC 2 is bijective, and (b): (X,Y,Z) 
is independent of (Ci,C 2 ). ■ 
The DMS (X, Y, Z) is a vector source, and we do not have 
a closed-form expression for the secret key capacity with rate 
limited public-rate communication. However, if Alice and Bob 
ignore one of their observations, the DMS reduces to a degraded 
scalar source. By JT7J Corollary 2], there exists a function / 
with closed-form expression such that: 

• If Alice ignores Y\ and Bob ignores X 2 , we have Y 2 «-» 
X\ «-» Z. In this case, if Bob sends public messages at rate 
R p , Alice and Bob can distill a key at rate Rk, such that 

Rk < / (R p ,Py 2 x 1 z)- 

• If Bob ignores Y 2 and Alice ignores X\, we have Y\ •<->• 
X 2 <-> Z. In this case, if Alice sends public messages at 
rate R p , Alice and Bob can distill a key at rate Rk, such 
that R k ^ f (RpiP^Xiz)- 

With the explicit characterization of the DMS induced by 
cooperative jamming and the function /, it is possible to compute 
new achievable rates for the strategy described in Section [IV] 
Although we do not have a closed-form expression for the 
resulting region 7Z K , it is possible to prove that the region strictly 
includes the region 7Z F in Proposition [2] strengthened for strong 
secrecy. 

Proposition 4: Let us consider TZ F , TZ K , and TZ 2W defined as 
before. In general: TZ F C TZ K C 7Z 2W . There exists channels 
such that K F CK K . 

Proof: The first statement follows directly from the definition 



of the key generation strategy in Section IV For the second 



statement, consider the example of a channel for which: 

h 2 - 1 hi - 1 

< pi < — and < p 2 < — , . 

hi h 2 
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Secret rate R[ (bits/channel use) Secret rate Rj (bits/channel use) 



Fig. 4. Region evaluation for pi 
91 = 32 = 1 



1, p2 = 100, hi = 1, /12 = 0.1, and Fig. 5. Region evaluation for p 1= p 2 = 1, h\ = h 2 = 1.5, gi = g 2 = 1 

0.6 r 



In this case I{C X \Y 2 \X 2 ) < 1(0x1 Z) and I(C 2 \Y X \X{) < 
I(C?2; Z), and the region 7£. F is empty. However, since the power 
constraints are non-zero, a fraction of the power can be used to 
induce a DMS while still maintaining a positive auxiliary message 
rate. By (T7J Theorem 3], it is possible to obtain a non-zero key 
rate and, therefore, a non-zero secure communication rate. ■ 

Remark Although we only prove 1Z F C 1Z K by exhibiting a 
dummy example, our numerical results in the next section clearly 
show improvements in various cases. 

B. Numerical results 

We first consider a situation in which secret key generation 
provides little gain because cooperative jamming leaves little 
room for improvement. Fig. |4] illustrates the region 1Z F and TZ K 
obtained for p\ = 1, /? 2 = 100, hi = 1, hi = 0.1, and 
gi = 92 = 1. The upper left corner of the region corresponds 
to a situation in which Alice uses all her power to jam (p™ = pi) 
while Bob uses all his power to transmit (p\ = pi). A secret 
key can be extracted from the DMS induced by Alice; however, 
since h\ = 10, Eve's source observation is highly correlated to 
Alice's, which severely limits key rates. The upper right corner 
of the region corresponds to a situation in which both Alice and 
Bob use their entire power to transmit (i.e. pi — p\ and p\ = p 2 ) 
and, therefore, no DMS is induced. For comparison, we also plot 
the region TZ obtained using key generation alone (no cooperative 
jamming). Although this strategy is clearly suboptimal, note that 
there exist practical coding schemes for key generation over 
Gaussian channel; therefore, the region TZ provides an estimate of 
rates achievable with current codes. We also plot the best known 
outer region H out for the two-way wiretap channel computed by 
He and Yener |26l . 

Fig. [^illustrates the region 1Z F and TZ K obtained for pi = pi = 1, 
hi = h 2 = 1.5, and g\ = 52 = 1- This corresponds to a situation 
in which Eve obtains a better observation than either Alice and 
Bob and in which Alice and Bob have little power available. In 
such a case, key generation provides a significant improvement. 
Finally, Fig. [6] illustrates the region 1Z F and TZ K obtained for 
Pi = Pi = 0.9, hi — hi — 10, and gi = g 2 = 1. In this case 



S 0.5 



0.4 



e °- 3 - 

% 0.2 



0.1 



0.0 



K K 



1? 



TZ 



ft™ 



0.0 



0.1 0.2 0.3 0.4 

Secret rate Rj (bits/channel use) 



Fig. 6. Region evaluation for pi = P2 = 0.9, hi = h 2 = 10, g± = g 2 = 1 

TZ F = 0, but key generation is possible. This case corresponds 
to the situation used in the proof of Proposition [4] 

VI. Conclusion and Perspectives 

In this paper, we have developed an achievable region of 
strongly secure rates based on strategies that partially decouple 
the use of interference and feedback for secrecy. We have first 
exploited interference by using a cooperative jamming strategy 
on top of which we have introduced some basic feedback 
mechanisms. We have relied on key exchange to transfer secure 
rate between users and we have performed key generation to 
distill secret keys from the noise sources induced by cooperative 
jamming. Numerical results in the Gaussian case have shown 
significant improvement in some cases. 

Our results can naturally be extended in several directions. 
First, note that the key generation process we considered is 
based on one-way communication between the two users. There 
exist sources for which two-way communication is provably 
better than one-way communication [3 1; we can exhibit a wiretap 
channel based on those sources for which the same result would 
hold. Second, we can extend the Gaussian two-way wiretap 
channel to multiple antennas by relying on the results of Khisti 
and Wornell (27) and Oggier and Hassibi (28) for the MIMO 
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wiretap channel, and Watanabe and Oohama 1 17 1 for secret key 
agreement from vector sources. Third, we could generalize our 
results to more than two legitimate users. While this poses no 
major conceptual problem, generalizing Lemma [2] might not be 
so straightforward. Fourth, the results obtained for the Gaussian 
case rely on an explicit characterization of the DMS induced 
by cooperative jamming; it would be interesting to generalize 
the approach beyond channels with an additive noise structure. 
Finally, our results generalize to known channels with memory, 
such as wireless channels with ergodic fading |29|, 1 30 1 , by using 
the general result of Steinberg on channel resolvability for the 
multiple-access channel [19|. 



Appendix A 
Proof of LemmaQ] 

Let us define: Mi = \2 nRl ], M 2 = \2 nR2 ], M[ = 



and M 



/ A 
2 — 



, and let C be the random variable representing 

a randomly generated code. Let 1 e > 0. 
We show that, without loss of generality, we can restrict our 
attention to the transmission of a single message: 

E(P e (C)) = E E P e (CVi,M2 sent)POi,|U2 sent) 

\ /j, 2 £M 2 xM 2 

= P(Mi,M2 sent) E c (P e (C|/ii,M2 sent)) 

«c(p.(ciu»t)) 

= E(P e (C|l,l sent)) 

(b) 

< E(P(^i ^ sent,C)) 

+ E(P( M2 96 Aa|l,l sent,C)). (23) 

Equality (a) follows from the symmetry of the random code 
construction, while inequality (b) is given by the union bound. 
Each term can be expressed using the following events: 

. £(i,j) = {(X?,C2(i,j),YT)€AZ e } 
. = {(X$,C?(iJ),Y 2 n ) e Al e } 

Now, we compute: 

E(P(/i 2 + sent,C7)) 

V(1,1)V \/ £(i,j) 

< p(g c (i,i)) + p (£(m)) 

6(e) + M 2 M' 2 exp 2 (n(H(X 1 C* 2 yi) + e)) 

^ oxp 2 (n(i? 2 + R' 2 + S{n))) 

exp 2 (-n(H(C7 2 ) - e)) • exp 2 (-n(H(X 1 y 1 ) - e)) 

= 6(e) + exp 2 (n(i? 2 + R' 2 - I(C 2 ; Yil^i) + 6{n) + 3e)). 

(24) 

The second inequality follows from the union bound, and the 
penultimate from the AEP. 



If the rate constraints in |6]) are satisfied, there exists a 7 > 
such that R 2 + R' 2 < G 2 \X\) — 7, and choosing e such that 
7 + 3e > 0, we obtain: 

lim E c (P(/i 2 A2II, 1 sent, C)) < 6(e). 

n— foo 

By symmetry, we obtain, by a similar reasoning on T: 

lim E c (P(>i f sent,C)) < 6(e). 

n— >-oo 

Therefore: lim E(P e (C*)) 6(e). QED 



Appendix B 
Proof of Lemma[2] 

Lefle > 0. 

An upper bound for the leakage using divergence: 



L(C)=l(Z n ;MiM 2 \C) 

= ^{pm 1 m 2 z™\c\\pm 1 m 2 \cPz™\c) 

Mi M 2 

= E E E PM 1 M 2 z^\c{mi,m 2 ,z n ) 

jni — 1 m 2 — 1 z n €:2i n 

PM 1 M 2 zn\c(mi,m 2 , z n ) 



(25) 



log 2 



32 PM 1 M 2 \c(mi,m 2 )pz^\c(z n ) 

Mi M 2 

E E E Pz-\M 1 M 2 ,c(z n \m 1 ,m 2 ) 

mi— 1 m 2 — 1 2 n £2 n 

Pz"\M l M 2 .c( zn \'mi,m 2 ) 



PZ"\c(z n ) 



PM 1 M 2 (mi,m 2 )log 2 

^ Mi M 2 

IF E E HPZ"\ mi ,n 2 fi\\PZ-\c) 



MiM 2 

^ ivnu" E E D (Pz™\ mum2 ,c\\p z ™\c) 



mi —1 m 2 — 1 
Mi M 2 



MiM 2 

m i—l m.2—1 

+ H(p z »\c\\Pz™) because: D(-||-) & 

^ Mi M 2 

TT E E ^(pz-lmx.r^.clbz-). (26) 



MiM 2 



mi —1 m 2 — l 



Taking the expectation and using the symmetry of the random 
code construction, yields: 



E C (L(C)) =I(Z n ;M 1 M 2 \C) 

^ Mi M 2 

51 E Ec(B(Pz»| mi , ma ,clbz»)) 

rn i—l 7712 — 1 

= E (D(pz»|i,i,c||Pz»))- (27) 



For convenience we shall add extra conditions on e as needed. 
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An upper bound for the divergence: : 



l>(Pz»|l,l,cl|Pz™) 

= E Pz»\i,i,c(z n )k>g 



E Pz"|ia,cO™)log 2 



Pz"\i,ifi(z n ) 
2 Pz~{z n ) 



, , , Pz»|i,i,eO") 



E Pzn\X,lfi{z n )\0; 



•'2 



Pz»\i,i,c(z n ) 
Pz*>(z n ) 



«S e+ E P \i A, c(z n ) log. 



. , . Pz»|i,i,eO ) ^ 
Pz»|i,i,c(z") 



1 lOg; 



PZ"|l,l,c(z") 
Pz«(-2 n ) 



> e 



(28) 



By the law of total probability: 



Pz»(« n ) 

= E E pz»ic?c ? (^|^,c5)p^(^)p^(<5) 

> E E Pz^c 5 (z n \c^^)Pc Y (c r l)pc S (c n 2 
^M / 1 M^XP^n,Pz»H,i,c(« n ) 5 



where Bi(m), for i e {1,2}, represents the set of codewords 
associated with message m for user i. To obtain the last inequal- 
ity, the p.d.f. of C\ and C 2 must have compact support, which 
can always be obtained by cropping (to get a compact support) 
and scaling (to keep an unit area) the p.d.f. If C\ and C 2 are 
derived from C\ and C 2 with discrete or Gaussian p.d.f., it is 
possible to get V ypci j PC ) an ^ V (pc 2 ; Pc 2 ) as sma U as we 
want. Since I(X; Y) viewed as a function of px, with py\x 
fixed, is continuous, the mutual informations involved in (|8]l are 
hardly modified by using C\ and C 2 instead of C\ and C 2 . 



By taking the expectation of (|28[l and with [19], we have: 



where J e is defined as: 

E-E E-E 



4 2 ) eCrc ( M i) eCr 4 2, ec ? 4 M 2) 6C? 

Pc,(cf))---p C? (cr))p c? (^)...p c? (4^) 



(1) r 
c 2 , Z 



x E E E Pcpc»z< 



(ij)^(l.l) 



> l+4e 



An upper bound for J t : We remind the following assumption 
from ([8]): 

' R[ + R 2 > I(CiC 2 ; Z) 
i?; > I(Ci;Z) 
[i? 2 >I(C7 2 ;Z) 



(30) 



The quantity J e can be upper bounded as (see |19|): 

J 6 < JW+J(2)+ J(3) + JW, 

where JW, j( 2 \ j( 3 ), and j( 4 ) are defined as: 
1 



J(2) 



M'^ 6XP2 



M 



J(3) 
J(4) 



M 



>l + e 

1 ™ 

^E ex P 2 (^c ? ^ (c»C< l >;2»))> ( 
1 2 i=i 
i " 



i=i 



Now, we study each term individually: 

. First, jW can be upper-bounded as follows: 

exp 2 (— ne + ni?^ + nR' 2 )) 
l I{C^C r 2 L ; Z n ) > -e + i?i + R' 2 



'[n E / ( C 'i^2, l ; Z t ) > iZi + i? 2 - e^J 



E C (L(C7)) = I(Z»; MxM 2 \C) sC e + nlog 2 ( — ] J e , (29) 



since + i? 2 > I(CiC 2 ; Z), there exists 7 > such that 
R' x +R' 2 > I(CiC 2 ; Z) +7. If we choose e < 7 to guarantee 
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R[ +R' 2 -e > I(C7iC7 2 ; Z) +7 - e and to apply the Chernoff 

>o 

bound, we have: 



*7— e 



> 0, J« sC 



• With a similar reasoning, we can upper bound J^ 2 \ 
and j( 4 ) by quantities going exponentially to zero under the 
given conditions. 

Conclusion: : J e goes exponentially to zero as n goes to 
infinity. Therefore, lim E(L(C)) < (5(e). QED 

n— >oo 
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